BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1827873002

Cr-Commit-Position: refs/heads/master@{#35055}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1832653002

Cr-Commit-Position: refs/heads/master@{#35054}

Based on CL 1777883002.

BUG=chromium:590975
LOG=NO

Review URL: https://codereview.chromium.org/1813963002

Cr-Commit-Position: refs/heads/master@{#35053}

It might happen a script is gone during profiling. Handle that case.

Review URL: https://codereview.chromium.org/1826953003

Cr-Commit-Position: refs/heads/master@{#35052}

Introduce TruncateTaggedToFloat64 and TruncateTaggedToWord32 into the
CodeStubAssembler, which encapsulates the ToNumber truncation and
returns the resulting number as either Float64 or further truncated to
Word32.

R=jarin@chromium.org
BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1827813004

Cr-Commit-Position: refs/heads/master@{#35051}

Rolling v8/build/gyp to 8e8c3178d9d2734a6223b87fbd45ab250baf77e8

Rolling v8/tools/clang to c789a99803595dfa963ba300ac79b760d1304d8c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1834583002

Cr-Commit-Position: refs/heads/master@{#35050}

ES#sec-islabelledfunction specifies that labelled function declarations
may not occur as the body of a control flow construct such as an if
statement. This patch implements those restrictions, which also
eliminates a previous case resulting in a DCHECK failure which is now
a SyntaxError.

BUG=chromium:595309
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1808373003

Cr-Commit-Position: refs/heads/master@{#35049}

This was previously undetected due to a now fixed typing bug.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1823333005

Cr-Commit-Position: refs/heads/master@{#35048}

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1832623003

Cr-Commit-Position: refs/heads/master@{#35047}

Properly convert unsigned literals.
Forbid using unary + on a kAsmInt.
Forbid multiplies other than * 1.0 as being equivalent to unary +.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1832603002

Cr-Commit-Position: refs/heads/master@{#35046}

R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1825333004

Cr-Commit-Position: refs/heads/master@{#35045}

BUG=

Review URL: https://codereview.chromium.org/1826023003

Cr-Commit-Position: refs/heads/master@{#35044}

R=hablich@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1822263003

Cr-Commit-Position: refs/heads/master@{#35043}

BUG=chromium:597310
LOG=NO

Review URL: https://codereview.chromium.org/1828743002

Cr-Commit-Position: refs/heads/master@{#35042}

This got fixed by this change:
    https://crrev.com/32a2ab0c724673961aa145ab63c79a29e6d28fa8

Adding a smaller mjsunit test capturing the issue (was with idiv register allocation).

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=593283
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N
TEST=asm-wasm-copy

Review URL: https://codereview.chromium.org/1820163002

Cr-Commit-Position: refs/heads/master@{#35041}

BUG=590936
LOG=N

Review URL: https://codereview.chromium.org/1816393002

Cr-Commit-Position: refs/heads/master@{#35040}

NOTRY=true

Review URL: https://codereview.chromium.org/1829753002

Cr-Commit-Position: refs/heads/master@{#35039}

Reland of [elements] Minor hardening and cleanup of concat (patchset #1 id:1 of https://codereview.chromium.org/1825363002/ )

Reason for revert:
Test disabled. See:
https://codereview.chromium.org/1830583002/

Original issue's description:
> Revert of [elements] Minor hardening and cleanup of concat (patchset #7 id:120001 of https://codereview.chromium.org/1812753004/ )
>
> Reason for revert:
> [Sheriff] Something seems to leak:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10838
>
> I don't see the direct connection to this CL though...
>
> Original issue's description:
> > [elements] Minor hardening and cleanup of concat
> >
> > BUG=
> >
> > Committed: https://crrev.com/b98b3fbbe3dd14548cb356339f52403c07ef33f4
> > Cr-Commit-Position: refs/heads/master@{#35027}
>
> TBR=jkummerow@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/d30d861a0cb0da11efd3b30eb3d03fbe56b4ba23
> Cr-Commit-Position: refs/heads/master@{#35028}

TBR=jkummerow@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
BUG=

Review URL: https://codereview.chromium.org/1827573003

Cr-Commit-Position: refs/heads/master@{#35038}

Deoptimizing from the stub is fairly slow, so add support for the other fast-path cases to avoid deopts. Notably, push with multi-arg is used by pdfjs.

BUG=chromium:597252
LOG=n

Review URL: https://codereview.chromium.org/1825843002

Cr-Commit-Position: refs/heads/master@{#35037}

NOTRY=true
TBR=oth@chromium.org, rmcilroy@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1830583002

Cr-Commit-Position: refs/heads/master@{#35036}

Reland of [counters] adding runtime call timers for GC (patchset #1 id:1 of https://codereview.chromium.org/1827563003/ )

Reason for revert:
Reverting doesn't help here :/ Will disable the test.

Original issue's description:
> Revert of [counters] adding runtime call timers for GC (patchset #4 id:60001 of https://codereview.chromium.org/1825093002/ )
>
> Reason for revert:
> [Sheriff] ASAN bot is really badass today:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10844
>
> Original issue's description:
> > [counters] adding runtime call timers for GC
> >
> > Adding an additional timer for the GC to make the other runtime call counters
> > more stable.
> >
> > BUG=
> >
> > Committed: https://crrev.com/9ec649638d553a891b0356155f4f15f3a260c1af
> > Cr-Commit-Position: refs/heads/master@{#35033}
>
> TBR=ulan@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/a1521c90d54bf4cdaaf4c6ae549d297d5779ac08
> Cr-Commit-Position: refs/heads/master@{#35034}

TBR=ulan@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1826833002

Cr-Commit-Position: refs/heads/master@{#35035}

Revert of [counters] adding runtime call timers for GC (patchset #4 id:60001 of https://codereview.chromium.org/1825093002/ )

Reason for revert:
[Sheriff] ASAN bot is really badass today:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10844

Original issue's description:
> [counters] adding runtime call timers for GC
>
> Adding an additional timer for the GC to make the other runtime call counters
> more stable.
>
> BUG=
>
> Committed: https://crrev.com/9ec649638d553a891b0356155f4f15f3a260c1af
> Cr-Commit-Position: refs/heads/master@{#35033}

TBR=ulan@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1827563003

Cr-Commit-Position: refs/heads/master@{#35034}

Adding an additional timer for the GC to make the other runtime call counters
more stable.

BUG=

Review URL: https://codereview.chromium.org/1825093002

Cr-Commit-Position: refs/heads/master@{#35033}

Revert of [CQ] Make gn bot temporarily experimental. (patchset #1 id:1 of https://codereview.chromium.org/1829673002/ )

Reason for revert:
Bot compiles blink only now and works again.

Original issue's description:
> [CQ] Make gn bot temporarily experimental.
>
> TBR=sergiyb@chromium.org, dpranke@chromium.org
> BUG=chromium:481693
> LOG=n
> NOTRY=true
> NOPRESUBMIT=true
>
> Committed: https://crrev.com/b072760b99f45839e6b4ebeffc46c5d4e8c3a6e3
> Cr-Commit-Position: refs/heads/master@{#35026}

TBR=sergiyb@chromium.org,dpranke@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:481693

Review URL: https://codereview.chromium.org/1826783002

Cr-Commit-Position: refs/heads/master@{#35032}

RecordWrites is not performing black to grey transitions anymore. In a follow up CL I will clean-up the remaining sites where we do black to grey, e.g. when we overflow marking deque.

BUG=

Review URL: https://codereview.chromium.org/1823783003

Cr-Commit-Position: refs/heads/master@{#35031}

Port 1134688c

Original commit message:
    This roughly doubles performance for generic Array.prototype.push.

R=verwaest@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1826533004

Cr-Commit-Position: refs/heads/master@{#35030}

Add BitwiseAndStub, BitwiseOrStub and BitwiseXorStub, and hook them up
with Ignition and TurboFan.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1825793002

Cr-Commit-Position: refs/heads/master@{#35029}

Revert of [elements] Minor hardening and cleanup of concat (patchset #7 id:120001 of https://codereview.chromium.org/1812753004/ )

Reason for revert:
[Sheriff] Something seems to leak:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10838

I don't see the direct connection to this CL though...

Original issue's description:
> [elements] Minor hardening and cleanup of concat
>
> BUG=
>
> Committed: https://crrev.com/b98b3fbbe3dd14548cb356339f52403c07ef33f4
> Cr-Commit-Position: refs/heads/master@{#35027}

TBR=jkummerow@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1825363002

Cr-Commit-Position: refs/heads/master@{#35028}

BUG=

Review URL: https://codereview.chromium.org/1812753004

Cr-Commit-Position: refs/heads/master@{#35027}

TBR=sergiyb@chromium.org, dpranke@chromium.org
BUG=chromium:481693
LOG=n
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1829673002

Cr-Commit-Position: refs/heads/master@{#35026}

Port b6419fa2

Original commit message:
    Now implemented as a builtin that delegates to the InstanceOfStub. That
    stub was parameterized to fallback to either Runtime_InstanceOf or to
    Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
    Once the feature stabilizes and the flag is no longer needed, we can get
    rid of this parameterization again.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1827583002

Cr-Commit-Position: refs/heads/master@{#35025}

BUG=v8:4280,v8:4747
LOG=N

Review URL: https://codereview.chromium.org/1825103002

Cr-Commit-Position: refs/heads/master@{#35024}

The bytecode handler for ForInDone can just do a word comparison on
index and cache length instead of calling out to %ForInDone.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1825513003

Cr-Commit-Position: refs/heads/master@{#35023}

We use the pattern "B23" to refer to RPO numbers and "id:42" when
referring to unordered block ids. This unifies printing functions to
follow that pattern throughout the system.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1824313002

Cr-Commit-Position: refs/heads/master@{#35022}

Revert of [CQ] Reduce code-coverage experiment factor. (patchset #1 id:1 of https://codereview.chromium.org/1822703002/ )

Reason for revert:
More bots added.

Original issue's description:
> [CQ] Reduce code-coverage experiment factor.
>
> BUG=chromium:568949
> LOG=n
> TBR=kjellander@chromium.org, tandrii@chromium.org
> NOTRY=true
> NOPRESUBMIT=true
>
> Committed: https://crrev.com/76f677fc6d0b147603ddda2d5809086b0d36d900
> Cr-Commit-Position: refs/heads/master@{#34946}

TBR=kjellander@chromium.org,tandrii@chromium.org
BUG=chromium:568949
LOG=n
NOPRESUBMIT=true
NOTRY=true

Review URL: https://codereview.chromium.org/1816283004

Cr-Commit-Position: refs/heads/master@{#35021}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1823973002

Cr-Commit-Position: refs/heads/master@{#35020}

  port 66e22b79 (r34979)

  original commit message:
  ... because Debugger could still require them to inspect optimized frames.

BUG=

Review URL: https://codereview.chromium.org/1826673003

Cr-Commit-Position: refs/heads/master@{#35019}

  port 1da4b88e (r34978)

  original commit message:
  The idiv instruction has 2 registers as output. This needs to be
  modeled so that the move optimizer won't incorrectly elide away
  moves.

BUG=

Review URL: https://codereview.chromium.org/1823403002

Cr-Commit-Position: refs/heads/master@{#35018}

With the recent spec change removing the [[Enumerate]] internal method, we now
have to walk the complete prototype chain. This implies that we call the
[[GetPrototypeOf]] trap on proxies.

As a secondary change we now trigger the [[GetOwnProperty]] trap for the for-in
filter step to see whether the properties are still enumerable. Before we did this
in the key-accumulation phase. This way we slightly reduce the number of traps
invoked. Whilst this is not ideal, it comes closer to the Spec's example
implementation.

BUG=v8:1543, v8:4768
LOG=n

Review URL: https://codereview.chromium.org/1748923003

Cr-Commit-Position: refs/heads/master@{#35017}

We establish spilling blocks for ranges spilling only in deferred blocks
really late - just before optimization. This means frame elision logic
should happen after all dust has settled - even after optimization, since
we may lose spills after that (this is not currently leveraged).

Also enabled the elision algo for all functions, but forcing the first frame
to construct a frame for non-code stub cases.  This is preparing for a
subsequent change where we guide frame construction/destruction
solely based on the info produced by the register allocation pipeline.

BUG=

Review URL: https://codereview.chromium.org/1810333003

Cr-Commit-Position: refs/heads/master@{#35016}